29 ms·

I'd be wary of this policy becoming the norm. It would be pretty easy for malware authors to hijack useful-but-neglected projects by submitting moderately helpf

I'd be wary of this policy becoming the norm. It would be pretty easy for malware authors to hijack useful-but-neglected projects by submitting moderately helpful pull requests.

kibwen 14y ago
I think the bigger problem here is that Github is rather useless at gracefully abandoning a project. The usual solution is for an interested maintainer to fork the project and continue, but with any sufficiently popular project it's impossible to tell which forks, if any, have momentum. I feel like there's got to be a middle ground between the current "fork in obscurity" model and the OP's "commit bits for everyone" model. But I'm not smart enough to think of what that might entail.
- typicalbender 14y ago
  I like the idea Github providing an easier way to gauge momentum on a repository and then maybe do some sorting based on that. I can't tell you how many times i've been looking for a repository and a large number of them come up with no indication, other than number of starts and forks, about whether that is the main repository that is still maintained or not.
  - weaksauce 14y ago
    That could still be gamed by committing a lot if you are a malicious user. I'm sure they could figure out a way that would work but it seems the naive way is Not ideal.
    - kzrdude 14y ago
      Also remember that you can trivially fake author name, email and date in git and thus github. Only the github-side push log will tell which user pushed what, the commit log can lie all it wants. Most notably, you can backdate a commit and github won't even show it in the commit log (because it uses strict commit date order).
      - snprbob86 14y ago
        Yes, but also remember that you'll get loud warnings about non-fast-forwards thanks to the cryptographically secure SHA1 hashes. This means that the repo admins and downstream clones can trivially detect history rewrites for branches they have fetched. Unfortunately, there isn't a good way for code-consumers to tell if and when a non-rewrite commit or branch has been "blessed" by an admin rather than some random committer. I guess this means that the README should make some mention of the collaboration policy and the admins should preserve release power to whatever the relevant package manager is.
        kzrdude 14y ago
        You don't need to rewrite history. You just add new commits with fake author & date.
- moe 14y ago
  but with any sufficiently popular project it's impossible to tell which forks, if any, have momentum. Seconded. This is one of the pain-points I wish github would address. The constantly broken "network graph" and complete lack of (meaningful) tools to compare forks or branches is a royal pain in the ass. Many of the missing operations ("In which branches does commit X exist", "Show delta between A,B") shouldn't even be hard to implement. I don't understand why github spends their resources on useless gimmicks ("streaks", "pop repos") rather than pushing their core product.
  - markburns 14y ago
    Do you know about the compare view? http://jbuckley.ca/2011/09/githubs-compare-view/ http://jbuckley.ca/2011/09/githubs-compare-view/ http://zachholman.com/talk/git-github-secrets/ http://zachholman.com/talk/git-github-secrets/
nateabele 14y ago
Quoting from the article: So should you really do this for all pull requests? Probably not. While I've given a large amount of users access to various projects of mine, I'm still looking for: - Github profile: Does this user stand to lose a reputation by doing something stupid?

I'd be wary of this policy becoming the norm. It would be pretty easy for malware authors to hijack useful-but-neglected projects by submitting moderately helpful pull requests.

kibwen 14y ago

I think the bigger problem here is that Github is rather useless at gracefully abandoning a project. The usual solution is for an interested maintainer to fork the project and continue, but with any sufficiently popular project it's impossible to tell which forks, if any, have momentum. I feel like there's got to be a middle ground between the current "fork in obscurity" model and the OP's "commit bits for everyone" model. But I'm not smart enough to think of what that might entail.

typicalbender 14y ago
I like the idea Github providing an easier way to gauge momentum on a repository and then maybe do some sorting based on that. I can't tell you how many times i've been looking for a repository and a large number of them come up with no indication, other than number of starts and forks, about whether that is the main repository that is still maintained or not.
- weaksauce 14y ago
  That could still be gamed by committing a lot if you are a malicious user. I'm sure they could figure out a way that would work but it seems the naive way is Not ideal.
  - kzrdude 14y ago
    Also remember that you can trivially fake author name, email and date in git and thus github. Only the github-side push log will tell which user pushed what, the commit log can lie all it wants. Most notably, you can backdate a commit and github won't even show it in the commit log (because it uses strict commit date order).
    - snprbob86 14y ago
      Yes, but also remember that you'll get loud warnings about non-fast-forwards thanks to the cryptographically secure SHA1 hashes. This means that the repo admins and downstream clones can trivially detect history rewrites for branches they have fetched. Unfortunately, there isn't a good way for code-consumers to tell if and when a non-rewrite commit or branch has been "blessed" by an admin rather than some random committer. I guess this means that the README should make some mention of the collaboration policy and the admins should preserve release power to whatever the relevant package manager is.
      - kzrdude 14y ago
        You don't need to rewrite history. You just add new commits with fake author & date.
moe 14y ago
but with any sufficiently popular project it's impossible to tell which forks, if any, have momentum. Seconded. This is one of the pain-points I wish github would address. The constantly broken "network graph" and complete lack of (meaningful) tools to compare forks or branches is a royal pain in the ass. Many of the missing operations ("In which branches does commit X exist", "Show delta between A,B") shouldn't even be hard to implement. I don't understand why github spends their resources on useless gimmicks ("streaks", "pop repos") rather than pushing their core product.
- markburns 14y ago
  Do you know about the compare view? http://jbuckley.ca/2011/09/githubs-compare-view/ http://jbuckley.ca/2011/09/githubs-compare-view/ http://zachholman.com/talk/git-github-secrets/ http://zachholman.com/talk/git-github-secrets/

nateabele 14y ago

Quoting from the article: So should you really do this for all pull requests? Probably not. While I've given a large amount of users access to various projects of mine, I'm still looking for: - Github profile: Does this user stand to lose a reputation by doing something stupid?